CVE-2018-6596

CRITICAL

django-anymail < 1.2.1 - Timing Attack on WEBHOOK_AUTHORIZATION Secret

Title source: llm

Description

webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.

References (6)

Core 6

Core References

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2018/dsa-4107

Patch x_refsource_confirm

https://github.com/anymail/django-anymail/commit/c07998304b4a31df4c61deddcb03d3607a04691b

View Patch ZIP pw:eip

Release Notes x_refsource_confirm

https://github.com/anymail/django-anymail/releases/tag/v1.3

Patch x_refsource_confirm

https://github.com/anymail/django-anymail/commit/db586ede1fbb41dce21310ea28ae15a1cf1286c5

View Patch ZIP pw:eip

Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

https://bugs.debian.org/889450

Release Notes x_refsource_confirm

https://github.com/anymail/django-anymail/releases/tag/v1.2.1

Scores

CVSS v3 9.1

EPSS 0.0266

EPSS Percentile 83.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE

CWE-200

Status published

Products (3)

debian/debian_linux 9.0

django-anymail_project/django-anymail < 1.2.1

pypi/django-anymail 0 - 1.2.1PyPI

Published Feb 03, 2018

Tracked Since Feb 18, 2026